Voice of the DBA

Category: Editorial

  • Are You Patched?

    It’s been a few weeks since the Spectre/Meltdown bugs were announced for most CPUs. Microsoft has been working hard to build patches, and they’ve provided fixes for Windows and SQL Server. Other manufacturers have released fixes for other platforms, though I wouldn’t be surprised if more patches are coming. We put together a page at SQLServerCentral with information and links, and if you haven’t checked it out, you should.

    If you haven’t patched systems, patch them ASAP.

    This is a bad bug, affecting many CPUs, across multiple architectures, and includes potential issues with virtual machines. The guidance and conversations I’ve heard from various vendors is that many of them aren’t completely sure of all the potential risks or attack vectors, but they are worried that customers will leave this vulnerabilities open in the future. Since this affects hardware, it’s entirely possible that an exploit could read memory from other applications and processes.

    Again, if you haven’t patched systems, patch them.

    There are reports of potential issues, so everyone certainly needs to test systems. Perform a P->V (Physical to virtual conversion) and patch a VM. Make sure the server still runs. If you’re on VMs, snap a copy and patch it as a test. Older processors might see a performance penalty with the patch, but worse performance is better than having a security hole in your CPU available to operating systems.

    This is the type of fundamental architectural bug that’s is very worrisome. The race to be efficient, to copy what works from others, this leads to less innovation not more. I hope that this is a bit of a lesson that we do need separate architectures and approaches to computing problems, both in hardware and software. I love relational databases, but I’m glad that there are other types of systems being used for data storage. I think Windows works really well, but I like competition and think it’s good that we have MacOS, Linux, and more.

    It’s good to have standards and interoperability, but I do think that a heterogeneous environment is good for security, and I hope the world continues to try new architectures as we advance computing ever further.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 3.1MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • Innovation Needs Information

    We are great about sharing knowledge in the technical community. I think the SQL Server community is even better than most technologies as we do a good job of doing so without the rude RTFM that I find in other communities. However, overall we share lots of information with others. I do know that many other communities are catching up and I really appreciate the answers I’ve gotten from others when trying to repair my tractor or auto.

    As the world looks to bring innovative solutions to various problems, it seems that machine learning will play some role. There are some amazing advances taking place in all sorts of areas, and certainly no shortage of organizations that are trying to see if ML enhancements will improve their capabilities. We hear about ML all the time as data professionals, and some of you are starting to try and use these algorithms to build new applications.

    I ran across a great post about innovation that notes that the fuel for ML and related technologies is data. It’s important for training and evaluating systems, and there are companies making a lot of money providing training data. However, there is also lots of data inside companies, especially some of the big social media and communication companies that gives them an advantage. I think that’s OK, after all, these companies have innovated to build large scale enterprises and devoted resources to collecting data.

    However, I do think that more and more data is needed, and companies will work to collect it if they can. That means more and more of us will manage additional data, all of which needs to be cleansed, stored, managed, and protected. More work for us, but also lots of opportunity. Especially if you learn how to process data in new ways.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.9MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • How to Grow In Your Career

    This is a great thread on Twitter from Jim Burger, a long time software developer. The thread is a distillation of how he keeps a passion for learning across decades. I think it’s a good list of items, seven of them in total. I’ll give a quick summary, but he has a bit more depth in each tweet. The seven are:

    • Invest in your brain
    • Embrace exploration
    • Find the fun in fundamentals
    • Mentors from from all kinds of places
    • Use the community as an opportunity
    • You don’t have to finish learning
    • Ask people to ask you questions

    This is a great set of rules to help you learn. I certainly believe in the first one and that’s one reason I preach for you to keep learning. You can always get a little better and grow your skills. Apart from the fun, it helps train your brain to keep growing and stay flexible. I also think that finding the fun in fundamentals is great. I appreciate the simple things I accomplish, and I like writing about those. Part of the reason I keep doing #sqlnewblogger posts.

    I also think the community is a huge help. Someone asks a question, and even if it gets answered before you can, use this as an opportunity to solve the problem. Answer a question in our forums. Lots of people learn by helping others solve problems. In fact, plenty of my learning has come from solving problems for others. I get blog fodder, test myself, and solidify my own understanding of how things work.

    If you’ve found a way to continue to have fun learning, let us know today. I know that I tend to do a little but of everything, but certainly I take pride in what works, and even what doesn’t. The latter is always an opportunity for me to learn a bit more.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 2.9MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • The GDPR Sky is Falling

    David Poole wrote a nice summary of the GDPR regulations that come into force this spring in Europe. He covers a number of the sections, trying to provide a simple explanation of the potential issues from the perspective of a data engineer. That’s likely the role most of us fill , and I think David does a good job of trying to note the items that he (and maybe you) need to be concerned about.

    If you want to read the full text, and you should, it’s here. To me, this is a more sensible, easier to understand type of regulation. It’s way better than SOX and most other regulations I’ve had to deal with, with a better view of balancing the idea that companies won’t have all the answers, and might not choose the best technology but do need to make an effort. I don’t think this will excuse just continuing to do business as you have, but it does read as though courts and authorities will have flexibility in their interpretation.

    One of the main things that should be pointed out is that the 10 million Euro fine is a max, not a minimum. The same things goes for the potential 2% of global turnover (revenue for the US folks). These are the highest potential penalties, though if you have made some effort to protect data and comply, I doubt you’d see fines at this level unless you’re negligent.

    The keys parts of this regulation are that companies should be paying more than lip service to data privacy and protection. They should be designing and building software and infrastructure that protects data, and also considers the point of view of the individual or organization that is the subject of the data. That’s a good move, in my opinion, having us actually think about the data and the ramifications of its use, sale, transfer, and release, rather than just focusing on our own goals. Most data professionals I know keep this in mind, so GDPR is a step in the right direction to push management to care.

    We’ve got information at the Redgate site, which will help guide you. We are building features into existing and new products, and we’d love to sell you software if you can use it, but we’re also learning and trying to share what we know. This goes along with the core values at Redgate of being a part of the community and giving back, through SQLServerCentral, Simple Talk, blogs, and more.

    Ultimately no one knows what GDPR will bring, and its application can present a risk to any of us that gather data from EU residents. I know Brent Ozar as already decided to stop EU business for the time being to avoid taking on this risk, and I’m sure other small companies may do the same thing. In one way that’s a shame, though a reasonable decision for a company. In another way, this opens opportunities for other businesses. People in Europe still need goods and services, and there are plenty of ways to comply with GDPR that I don’t think will be too hard, especially for those businesses based in Europe that won’t have a choice. There will be other companies that can fill any void left by companies that cease working in the EU.

    GDPR isn’t the end of the world. I think it’s a good move in the right direction to balancing data value and protections. I’d like to see a better framework in the US that also ensures individuals have rights to exercise some control over all the data being gathered about them, as well as something that forces companies to actually consider data protection in their systems. There may be some bad results from GDPR, but most of us will adapt and continue to do business as we have in the past, albeit with better data controls.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 5.4MB) podcast or subscribe to the feed at iTunes and Libsyn.